tizen/src/sdl_rotate.c: Fix buffer overrun error reported by efence

Destination pixel is calculated using four source pixels. When source
pixel is got from last line or row next rigth or bottom pixel could
be not existent since we reached the end of src->pixels.

Signed-off-by: Evgeny Voevodin <e.voevodin@samsung.com>

diff --git a/tizen/src/sdl_rotate.c b/tizen/src/sdl_rotate.c
index e268c97ff69560695bbbcf13a97bee659ef70d98..8f07edc9ad9696b65834888bb78d6e36842b629c 100644 (file)
--- a/tizen/src/sdl_rotate.c
+++ b/tizen/src/sdl_rotate.c
@@ -638,7 +638,7 @@ void _transformSurfaceRGBA(SDL_Surface * src, SDL_Surface * dst, int cx, int cy,
                        for (x = 0; x < dst->w; x++) {
                                dx = (sdx >> 16);
                                dy = (sdy >> 16);
-                               if ((dx > -1) && (dy > -1) && (dx < src->w) && (dy < src->h)) {
+                               if ((dx > -1) && (dy > -1) && (dx < src->w - 1) && (dy < src->h - 1)) {
                                        if (flipx) dx = sw - dx;
                                        if (flipy) dy = sh - dy;
                                        sp = (tColorRGBA *) ((Uint8 *) src->pixels + src->pitch * dy);